Add RequestForgerySanitizer

Author: atorralba

java/ql/src/Security/CWE/CWE-749/UnsafeAndroidAccess.ql

@@ -13,6 +13,7 @@
 
 import java
 import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.security.RequestForgeryConfig
 import semmle.code.java.security.UnsafeAndroidAccess
 import DataFlow::PathGraph
 
@@ -25,6 +26,10 @@ class FetchUntrustedResourceConfiguration extends TaintTracking::Configuration {
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
   override predicate isSink(DataFlow::Node sink) { sink instanceof UrlResourceSink }
+
+  override predicate isSanitizer(DataFlow::Node sanitizer) {
+    sanitizer instanceof RequestForgerySanitizer
+  }
 }
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, FetchUntrustedResourceConfiguration conf

java/ql/test/query-tests/security/CWE-749/UnsafeAndroidAccess.java

@@ -147,6 +147,6 @@ public boolean shouldOverrideUrlLoading(WebView view, String url) {
 
 		String thisUrl = getIntent().getStringExtra("url");
 		// This should be considered safe - the query lacks a proper sanitizer for partial URLs.
-		wv.loadUrl("https://www.mycorp.com/" + thisUrl); // $ SPURIOUS: hasUnsafeAndroidAccess
+		wv.loadUrl("https://www.mycorp.com/" + thisUrl);
 	}
 }

java/ql/test/query-tests/security/CWE-749/UnsafeAndroidAccessTest.ql

@@ -1,15 +1,20 @@
 import java
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.FlowSources
-import TestUtilities.InlineExpectationsTest
+import semmle.code.java.security.RequestForgeryConfig
 import semmle.code.java.security.UnsafeAndroidAccess
+import TestUtilities.InlineExpectationsTest
 
 class Conf extends TaintTracking::Configuration {
   Conf() { this = "qltest:cwe:unsafe-android-access" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
   override predicate isSink(DataFlow::Node sink) { sink instanceof UrlResourceSink }
+
+  override predicate isSanitizer(DataFlow::Node sanitizer) {
+    sanitizer instanceof RequestForgerySanitizer
+  }
 }
 
 class UnsafeAndroidAccessTest extends InlineExpectationsTest {